c4aa7a168aa30297dcfb50db340c4972cd9d6f8ed92a2c9fedea686bfdefdb53

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.6MB
Sample261017-ehgrjsda44
SHA256 c4aa7a168aa30297dcfb50db340c4972cd9d6f8ed92a2c9fedea686bfdefdb53
MD5 e97bd205b918b539f7953c9ac20823f2
SHA1 74831b0af96cb30a8eb46a7196c25c4575b33ee7
SHA512 bd9f1d832ad89b08e496fd96d496d0d560f635e339db8f4563326670e2568a0c00d09b46a800510a73af814fe7f0531e486d1568ee3dc4e506188fb226963da6
SSDEEP 24576:rbdlZPzOFfSndwE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vdlZifSdLNiXicJFFRGNzj3
TLSH
T14475BF10169F0CABD897F13D8A618D4BD1F27C144B26C6AB66A02D1A7FB778369353C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3944	alg.exe
4772	DiagnosticsHub.StandardCollector.Service.exe
1524	fxssvc.exe
2668	elevation_service.exe
372	elevation_service.exe
3128	maintenanceservice.exe
904	msdtc.exe
2836	OSE.EXE
1728	PerceptionSimulationService.exe
4796	perfhost.exe
4908	locator.exe
4720	SensorDataService.exe
5104	snmptrap.exe
4988	spectrum.exe
3464	ssh-agent.exe
2124	TieringEngineService.exe
3864	AgentService.exe
852	vds.exe
1744	vssvc.exe
3348	wbengine.exe
2928	WmiApSrv.exe
4092	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e4dc02e45ef7726b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112140\java.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112140\javaws.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000065196b81eb5ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca178a81eb5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e6cb487eb5ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003cac4182eb5ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d9a2e82eb5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab433481eb5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005193f987eb5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000896bc282eb5ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074e13181eb5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a407281eb5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4772	DiagnosticsHub.StandardCollector.Service.exe
4772	DiagnosticsHub.StandardCollector.Service.exe
4772	DiagnosticsHub.StandardCollector.Service.exe
4772	DiagnosticsHub.StandardCollector.Service.exe
4772	DiagnosticsHub.StandardCollector.Service.exe
4772	DiagnosticsHub.StandardCollector.Service.exe
4772	DiagnosticsHub.StandardCollector.Service.exe
2668	elevation_service.exe
2668	elevation_service.exe
2668	elevation_service.exe
2668	elevation_service.exe
2668	elevation_service.exe
2668	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	1524	fxssvc.exe
Token: SeRestorePrivilege	2124	TieringEngineService.exe
Token: SeManageVolumePrivilege	2124	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3864	AgentService.exe
Token: SeBackupPrivilege	1744	vssvc.exe
Token: SeRestorePrivilege	1744	vssvc.exe
Token: SeAuditPrivilege	1744	vssvc.exe
Token: SeBackupPrivilege	3348	wbengine.exe
Token: SeRestorePrivilege	3348	wbengine.exe
Token: SeSecurityPrivilege	3348	wbengine.exe
Token: 33	4092	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeDebugPrivilege	688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	688	2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4772	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	2668	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 4792	4092	SearchIndexer.exe	112
PID 4092 wrote to memory of 3284	4092	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3944

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1720

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:372

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3128

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:904

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2836

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1728

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4796

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4908

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4720

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5104

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4988

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3800

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3864

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:852

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3348

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2928

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4792
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 153b6a216d9efc03060448c48a833e88ef3eb7e9508d79578df15958f1cb70fe
MD5 365cc8e9de8886292c7173aa37d66141
SHA1 516a1c325f36f1ed0036b5f94bbe49b2a3412314
SHA512 360323d9760fa3ced8393d155e8b5201dc3606803b1fbd800959aef7ad1ecfdfe8fb235aafcc064ac1ad98fc05d4f70d4c6f151f4950e49cd72f86694a4eb3b8
SSDEEP 49152:Ib+632BuPkFKRrdE6ohdstBhuXjfS4LWxn6LNiXicJFFRGNzj3:i3q6mjBF7wRGpj3
TLSH
T190D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 661607bfed653a4ce8946911564577c105528a4ffc22924f9aa5b71a07dfd752
MD5 b8f06f0eb01e478ecd52db301bd98bce
SHA1 cadebebb6211c73dde471b056271ed0e4cecbd8e
SHA512 e644a81cb5809d7c2f9a8e730dba5d7ffc808c240536648289406683b9033a1059fabef0556faf5be57d340480827110c6777c989319ee5f78cfb574ce6a32a2
SSDEEP 24576:/XYfDtczAJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KtcgLNiXicJFFRGNzj3
TLSH
T1D875012963D408F9EDBB813CC8A28411E6737C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 feb83201dbf722cb211feafdaf231da37eef0e00df660419d3aeec47102adff9
MD5 96bc9ae69099444121fffe601348b92f
SHA1 5c4589bd657886256f3a11d3267cd0f9e8c90d13
SHA512 1d10c908bdf17d77a0fdac55aef3bbf9181c16bb73db4ac6289855b367064fd2107c40a22a2f289648f9cb6cdcbcc7e33ccce17491451dafe6c8563fe1a6e26e
SSDEEP 24576:20Le5ji0hmxhrMC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2Pji0AzDLNiXicJFFRGNzj3
TLSH
T148859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a264cba5b423775031884cb78ddae248c01ca540b97c886f5dd6338f3183d3ce
MD5 98109ce66ad59a078b2720a5e3544875
SHA1 daae9d2323ff715219d7bdaf1ffb9084be9eb22c
SHA512 d8f9c5425372bbcea970b716406dfa34f73189a37965186117cc3644e0119c89712b2e61cc45baaeb7c315c0c0f6932a724c29f37515d77cc46b63f7bbad79f3
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWj6q8wyuw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8/ezSC6vUzPv+Hjy3LNiXicJFFRGNzj3
TLSH
T113756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ab020674b38f6030bddf2aec51cee140c96ace23ba21a25dfee33772d47c87c5
MD5 5784668893e304329f8eb3612888520c
SHA1 87aadd330799f167ee6f0d6291be5cb617c32ac4
SHA512 be6325567382264eaa5f91107334bc5d48c329396e49d53697e58cf68071930b5e5e7d192fd62b5c0e51aeb2dfeac4890e79a8a0f237b843ed765d66ab99c876
SSDEEP 24576:zVbqPb88hv/l+BV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zVO88hXl+jLNiXicJFFRGNzj3
TLSH
T134559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6a70eb9a9c69ede9329645c7c3e50e06c883948e74d0f2de638aad038c7a9228
MD5 56ca9c317d7390d92dc4db7ee07631a2
SHA1 2b8129f2036f0579ef4b8966ad55322ff4a813ac
SHA512 bc44f7c9f7908351cc868e7d1b0cdc4cdcc720425fa0725b9ba9530ef573e9cac72fd1301f1a6bf5c0dae82d13d0b4546997ab8424303f172c471fc46e0d23da
SSDEEP 24576:iGO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wLNiXicJFFRGNzj3
TLSH
T1055523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 f47e38530eaa812ba98bf242dcc33efbbce70d1eaa222430d6d9123e5225d387
MD5 a4ba1cb38f710d8c3d2c851fed616bf2
SHA1 35ce7a2abacfdd24af613c404348ed7efe976c76
SHA512 ecc79af58941ab9877668b7a677f17a93f26ce137032b2bab7fcfe213df7d8192fe2f34ab933535e9b6e311fc7730b443ba0c8d6fbeeb1d3ec442e6570480b90
SSDEEP 24576:yJIUd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yJIUdLNiXicJFFRGNzj3
TLSH
T16A75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 aaf1a37cfdbb05eb3092d948c077884d60093f7eef82cdc6b3cbb6d9f9ab5222
MD5 98924af79ffd448ebe3dfdb9d40ecfe6
SHA1 e01cd7226e18cd31fda6ed1512a876b61868fbec
SHA512 f85ae5618e42cd880a4425d2bac2c8c679b88106fe258e6905dbffa6a3c4a9bf9d5cb14140521e7edb7b37f53e8b6458065aafb60a84398070a0e08dbabb1907
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THV:wQvGAdlCEL8c/WRNw5CA7wRGpj3
TLSH
T18D266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 a0a5964f962e6d0b236ae03eef53c9291ffb847d47ba9a47d8036c4bfbb249b9
MD5 88f37e66423095618255da5e0830898e
SHA1 cbdd7a86c05cf978bc60ac713c491d61a5dfc36b
SHA512 487da4f378184b38fc364003f655f30203744722d9b74c24f67ec76e350663a708ffba3c3696c16d135cef3283da8162a73aecdcd53dd3a12df062ae2cebe73d
SSDEEP 24576:GfewsAjT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0ljTLNiXicJFFRGNzj3
TLSH
T10C75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d57b21ddc8d045f4f214a0438d0bbf60ed7da0779f6d95b56aed3f0413941001
MD5 1572a123b476edfdfe33399a2095d354
SHA1 43de0a9e0ab35e733bdb36a3c6ae68c902adde00
SHA512 c1ba81b9181fb0c0f4134079dc819ed432a15a7aabbdb0715b5414ea3e04d58bc47cad754f8363017218f3d23e266bde133f729a5a9591bb338ebf331a9f10f3
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHvF9:aUEtQevvqc2W1cpV20I32d9
TLSH
T154474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b470fe56ec7cf91ea1ae7c114067faa55f513d6a967bca163f67f212879a6aab
MD5 ee88f972c2ea90f53b0d77973cea2c2f
SHA1 19b7d4b9d1338f73232c9d9fffe28cd7f7fa33bf
SHA512 6a9954fa9b84ae76d4456666f8748c58900deee801343e3a450760b3f3792b5b34cc3ac3bc099deda7a11a78685496b320cf7a0aaf63c9d2d784bfaf8d6d1a09
SSDEEP 49152:FCbRquA/m2yL5zLfFiV+XenmE3/zzLNiXicJFFRGNzj3:Soq2VjnmU7wRGpj3
TLSH
T180D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 96edf817d4d048832a0d1a02ad7605bbfec8195750fea432f801725d1fb6ed57
MD5 8daea244b2b95ca78fe2cf7d336c2af2
SHA1 769e59edcfce9da64711ea8b9ad4b2ea9df9816e
SHA512 5314b33631d344cc612dd8ba1519d7d000c78458e4ad3005c4b4ea3da14c75f399e02be17b3b16d06ee02e38433248850b94fe02b4d85d6a510db949d6081952
SSDEEP 24576:XAhGL6IFoiwtA5l7S530/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XAM5Foiq5kLNiXicJFFRGNzj3
TLSH
T173359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 5db6fbf4ac0eb81998e1f45bb15c3f56150cb778d17c4e9709e5e375591b94bc
MD5 ab3a1aff139a02b125b9b44745c37ef1
SHA1 a7e623c003b589163daa97af33ec4dbf36fbac0d
SHA512 80094a23ea5abd8a1229aa94baa2ce4bc0719e339b1a10985b9de713a5d1e5b5b44b27b3b3b040bd154574cd8deb4fa5584d6d721f0f35d02e3b7ca9faecbdb6
SSDEEP 24576:ywuROWX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ywSO4LNiXicJFFRGNzj3
TLSH
T1EA65F18632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 17aa09dd272e80225c6336e938bc5276209011f40aa85a5424618feec468e711
MD5 86a323bda3d3223aa1e7ad0108356671
SHA1 2504031e7b90ab5f3cb9ce8aafa43d85657813bc
SHA512 796020c4058f216ba5c8695ec8935adbe67e24c67fa6c221c2a87f714b9a6fb2a1756c7ce969bec14c537a14570b3dfb67cd4d85cb8c70d141cdfca59dc3bcb9
SSDEEP 24576:oZuK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4LNiXicJFFRGNzj3
TLSH
T17555129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ed562e80c29cc112e1cb2798d136be811a512e98edcfacea47893edf1d6818a5
MD5 233c049e5d19306885a80c4973335e03
SHA1 2d9e100d7859a992bd7b021f75a9e1d80bcc24b3
SHA512 3786ebe3570bec661638a68672a7c2f0d6a4c0763a22e62bb73b225203bfc7c47073ccd4df614aa849e249deaef4b074931eb0f52658d9bacd402efa9d63a701
SSDEEP 98304:4QRQyi36YOcPDLvw2gAf+PN3R7wRGpj3:vQyiKanX+PNFF9
TLSH
T1A8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6988a1bada57f7a2f8a6dc4e667207bfa64269313d12ec87ff2f52f26db9f4c3
MD5 07f4cd326228a458a4be6419a4f84226
SHA1 a9fbddc007d3647461b6419e8a0f55d6d2329f81
SHA512 0788e2f3f779642c5485c8d78e7957dc3c843ab89d231575ebaaf9e1cc786a25ee2d5f1bb05e76cd36b6a9d8f8ba0191be822a900798b6c01fd9ea8a3094410e
SSDEEP 98304:oQRQyi36YOcPDLvw2gAf+PN3R7wRGpj3:/QyiKanX+PNFF9
TLSH
T14F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ee0e3c5a4fd34b3bb73eade2955c4a69147aa70fea56dc3dccc0f5b21eafa952
MD5 31d1e220efd30a99989a5fa154488d8d
SHA1 6b0a1d83f57bb90c1cabae363f589f60d8cf4ce4
SHA512 93baf900db281f874b1fcf9cefcf698933cafd511e253fcd40d7682d385ea5ed72fd371ca8b4c3b0da2622e5c03decb00c9ab19f8929cf8b0dfada8607f81eb3
SSDEEP 49152:R68Qg55nhkeWu7PNU3/DLNiXicJFFRGNzj3:PthTRc/D7wRGpj3
TLSH
T1F4B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9ef4eb7fe263ce6c8095c4d7c108e1bbaf3d44725e0a41a0d89fccafb30e6821
MD5 842a3d8748abbd36657f3f07c62444f2
SHA1 0b73d04d2475c81a9838f3905e478bc5ab22edec
SHA512 6a947ffa7b3e25c96a3188b9e95509ac53c9aeef111f9ee5537a45e372f51de5bdef2f1617adefc574f0982a70ebe24f056c8902fc5afd8d800e2f5692baf41e
SSDEEP 98304:Dy5112gYy5azzVvU69nLKnhZO7wRGpj3:eLIHRWhoF9
TLSH
T162167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4b78157f8c276a5c1e26857287ce4f938b0b7b6a939c09a0fa5b8836f36a2cfb
MD5 948e00ef7993217dfc3e9579c47563ee
SHA1 48c3e1997e3506a56d7f976844e96b6fb2c21da1
SHA512 49559f275d4dfc2edc058e7883c9d919614c446c353e91b70bed6ffe499b3e2ba62f58db8eeef7e58ed14ce87ecaf442f56f0c69bff836ed81ac92eaa2b23652
SSDEEP 49152:TB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl5LNiXicJFFRGNzj3:lu6JmIxd2d57wRGpj3
TLSH
T1B0D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 73c8bbb1ec122b934eea6649fc101704f165fb4228975e24dbe21f8afdc8c79f
MD5 f56ebaf40eec5521d1b942916e815753
SHA1 a5c8d5a5952a7c6b13179cd22b57095155641e73
SHA512 fc79c0106426842d3a7ab8ce09b33653844c9f60481c277b297376ca6a880c5cc6cb66c8d9eddc62130cbe423b28e88c7bda9bc0675b129b4e703e02c0ef9efe
SSDEEP 49152:Y1hpsNoJpF1A67U44CwH7R4x9LNiXicJFFRGNzj3:YmifPqRU7wRGpj3
TLSH
T1B8B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 89610ad515a96819ebdd6d45ec286473f03a2272fd485a9ce8384a5e4d8a6d8f
MD5 dc3d84d5b2c1525bd15544b0bef8863c
SHA1 e9e2801c7efeb1400abb983cab6212c1c3f0be67
SHA512 5eaab2b813a56c122f34154e7ab522472ac6a26f3d80977d551ceb3d83f28fb3b8c7abf82e38339554788191188684c72b33e8dc3f96c08370223e85eda40531
SSDEEP 49152:mSuZQIY0Be2KkRVtOnks6NMHqKLNiXicJFFRGNzj3:o5dKqi61K7wRGpj3
TLSH
T106C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1f887c419d3051820f5fb3e63cc815778deb8695e46b6b3ce760cdaf7253dd16
MD5 bd9c89ddbb40db8ff0dcfe0e16a83c78
SHA1 bfd3e0a3fe186c9520a49bf03bb88e6fae549333
SHA512 093b8584d24ca3269e0c68fa25e6e09ccf338af3b06f81934742791aa1d2654102a8b4e3b9d2d2cafece1df3ff528433293f8e90972c8be1419220bce838c3c6
SSDEEP 49152:OhtSn8EApI0figjgiDn0AP5wJLNiXicJFFRGNzj3:PX2iWphY7wRGpj3
TLSH
T17895BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1d0e2baf9498e28af98292e597f3882f8cf25c37d56bddf045ce518dfa4d98d1
MD5 d83d222dc14257532aecfaed3864ca5e
SHA1 1a8fdeb406def232b918c5974c64d5210dd70f81
SHA512 1acf32c95c2f2d378b4b15020cb871019babe0203c2d922351ed0bbe615640efeddbb5192ea69e7db297ff3f4a5bec0391f87af9fc3171e0579348227c1044eb
SSDEEP 12288:6MiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:62/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D85523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e8c081912188b2501913136d7a18f2f1a9fce4f76b79e0cc232c1a619011ada6
MD5 2a7b318e94d1400a6f99f886b351bf61
SHA1 2e35b9a0a8277f570364b098b0c26892a11cac0b
SHA512 ca92ab40bd144ed1bd5eb2dba071f92fb9b0c844f3f9f18aea20811ea78bf1afe284d8b55bbae08e84540b9dbf1074f38c9caf2f770360331e964b375ea7e636
SSDEEP 12288:j7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1605523D3548955B1FAFC0039C6754428F5886E2DEB5618E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e43e3c5d2b816318c5a773da29addc0d54c31fd7675543df977deb2fbaebe2b0
MD5 d20b3072d4fd17cd1dabe1284e15fa6b
SHA1 d71b00542e38594ac195d8458c0dd2614f35a5c6
SHA512 fc636348b9b1b6cbd6bc40e9efda01915c7e54d1341360700ac69f83d6d0918484dbae352af5afb5233f21af70b45b9822960c1930a6894eecd10a1d49e4d4f7
SSDEEP 12288:dZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18D5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 59c197d3b67161af91d72b44121a84ce272537221fb500c5bbdef6d9771a4cea
MD5 d46cb933c4f6de7be4dac4d81c27ae25
SHA1 f6a6d758ed566f1be1f1eceb813fa3c6cf1caf19
SHA512 f891bf038bf3d4c95c8f5538c330e52d942b730bf242f4c95198a8fbeb6a9fff3b3d570fade7e54f7238c2c6a3e3a1a83da3485052c0191f5eac4a25ce56da14
SSDEEP 12288:rVyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T107552393168901F1E9FD8039C6764424F2A47D6CD7325AEBD3003D1E5A74BEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4990fe6bd5a31f02afbbfbce14c30f245d923dff297c843e799a4a71fdd4e243
MD5 39d7ac3a41f707e6f9ff298b5d2e4793
SHA1 caeade6211dfcb5f82ea28dd2b6989b0d459b2b2
SHA512 0ed4ff6e065bc423ff06d940104d89a0ec37fdaf9972038ccfcba863d211a453a28bd74f18551213cece3a60c56b0de7b34381b63da6a858d001ec75a3448997
SSDEEP 12288:MKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:MM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F25523D3558955B1F6FC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 df6c794de92967af134b12dc69639d2eb59ce99ada522567116a4aa9fbb817ff
MD5 2996899a04478c5c0d086aefac7fa498
SHA1 0df20248a126cc3e5e8ca1c00a93f5dea0edcb1d
SHA512 559f18182e3e3aadb833f4eccd7586ed9e9f5182cae82883265bd0aae302dad507165ba4717bda6c9197d151ac05b8f4a2299b49d28148d9f2bce15b663bf6b6
SSDEEP 12288:AviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ab/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1305523D3558955B1FAFC0039C6754428F5882E2DEB5619E3E2083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4ed378955e0c1d784d7b0deb4a79b15e898063721a7d0453c1837361afe7cd32
MD5 4bfbf45adee0ef1769510f831b39cc8f
SHA1 a89906c2d9a68eff4c12714707077e0c9a358fc7
SHA512 d2364413fcb565d50e0e710be13beb73b3fd91f298c1a9d1717f591762611b2bb895a08cb2a3eb3f80f7f20b4c1db0dfc2852e27bacbaae03ec2c164d0128d60
SSDEEP 12288:8ziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8H/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13B5523D3558955B1FAFC003986354428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 78bab57d3fe59c7b270a27c0443a3d85f12501136633a459b28fcbca66d77559
MD5 0f35651a36475367785f49c10e426712
SHA1 7c380261e2228a5c6cc5de670f527b7d8fb5d3e3
SHA512 9f3d0a2ac4567ae1402b696389a5b402e7894f3bc537fc19ee7e8f24bed8212cb3ee2b3ba4568011a0631b59b94cf710efd625309464c6505ee9d0ed5d0e47c6
SSDEEP 24576:PZM3zFVSOP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PZM3zfrLNiXicJFFRGNzj3
TLSH
T174750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ea79968ad215910f46fa207c08024caf2e9dbb1fed1aa0760f767975b2225432
MD5 f59dd5b937a405dc908ffa589914bd9b
SHA1 fc9fd299f691654c8af78774dd104970944cd458
SHA512 c31558e4607b13becae3a266eee689b7eaf6d89d1fea6fd043e63df5de4f7bea67f0fe37c97fb5703f8372defb0ebe5d24cd1120e3771ce577c0cc62c667bc5d
SSDEEP 12288:coiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ca/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1925523D3558955B1FAFC003DC6754428F5882E2DEB5619E3E2083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 440bd7c485b628e577177e07b7a2d3e28c3994f6e3a2eb2cf19da1e70fb55dff
MD5 8242239eb48182cfd41f1b70fb95d048
SHA1 2b87f6694dfc2a84ee757f47cc7bb57573ccc78d
SHA512 67ecf397142c6651f589cc7df07459c81f663de524f09e74e87643ac5bde18afeb1bf71f74b11cb98fd72b8a503e43c3e0316d502061052b6cc76b1eee75acb7
SSDEEP 12288:70iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7e/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1465523D3558945B1FABC0039C6754428F5886E2DEB5619E3E2083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 de73e835dd9078853c45331a1517fb5ce8609fd10b5fba7aa41e2a6a5558dc1a
MD5 49ba19f1dcd9e82cc03ca504b988f125
SHA1 7892d95d49e6aafdadff2307c80a3004fce1a54e
SHA512 114cb1f8e764190c40165f3ddd923782d34ffe04d7dd2b90b0cc9bb5b31dd0a42033c0954200288f0af7df789ddbb12ef7625343776e6ec800c5844a3a655a24
SSDEEP 24576:gzyj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gYLNiXicJFFRGNzj3
TLSH
T177650247629530F9E17A8139C9620915F3717C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6158246a4989b889be3762d078968a80349cf618801493029af72802d61c2d5b
MD5 778d2345f0af36c03e2ed75ec465a10a
SHA1 9a892a6530c8373b079af6815636f77fcc96a4ab
SHA512 812083ec99c81604a0770ccb733757ce10212b54c4b927e3318b56f7c5428109dc898df63e2d1e89e87a9c62e5d751a26f9cdbef90573b56e35b48eda9473c9d
SSDEEP 12288:7oiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B75523D3548955B1FAFC003DC6754428F5882E2DEB5619E3E2083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 52c692b33a160f0c986756351dc6333120bcfd42968412d010e9c0d9e599b6ab
MD5 630d721f563be63bbca59b92b2aa3d31
SHA1 e6ba382d6721067018402e78c85c364e46d8eeaa
SHA512 7cd6601d9fcae4cc5885e92208d85147194c66d35a921bbb7c7a31a413c9ecf11dda3f14cfe3d759c55c7d40e274d39d7646c9e052703c00cf7bb33569af0c41
SSDEEP 12288:RoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ra/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C15523D3558955B1FAFC0039C6754428F5882E2DEB5619E3E2083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 3f20d87eaf21489cbf91ab0e265ff9ef6027c45263ba561db101f9eb1c728de5
MD5 56b992acedaf51949de00c0222e6f04f
SHA1 30bbf533dde3a916802e4ac2054775d6a1ea987c
SHA512 1ddd6bba76baf84ee9ad2a586932c81c80e05eb7d4c83026a47822e878a6d3d578ef2427c07b1b405451a0d4e289877a461bcd75a311a039ad0e8766bcdda576
SSDEEP 24576:nzyj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nYLNiXicJFFRGNzj3
TLSH
T1AD650247629530F9E17A8139C9620915F3717C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 1db78497520275adec138174614c2b5464121e6f9769a7b2803c8273dba0345d
MD5 7a3f0edc6755907cd8f3e125fdcbcd47
SHA1 68331542faf461ef123f2a41eb9e904b0b2ed0b3
SHA512 d6373686c0987f1a881d86389545e501776d8d78268a105698dfe5fc5f7dd28481dcd240d78d13cf039f36a88b30dfe812013a6cdcff031e5133923f25404a27
SSDEEP 24576:ccP4mcvIjkGOxhKP2l71nNKbrh/8KBy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XP4m4IpOO67W8KALNiXicJFFRGNzj3
TLSH
T1AD65AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e693791851e9515c3f23c3d56a3343679c6c01ff693f9e80e06f9b5ea5d89c68
MD5 519e6d709a58dc39cfad2e20f592242e
SHA1 46daf268c804af0708499e7a808b2f1202709b7f
SHA512 74ac566a5b75fc7311d1e19a9b3e7d5afcad8d435ae50eab1500f2e588441f2984d93b4120256f0cb289dc69f0d91dac1cbb06dab6950da7f635cbb581884d3e
SSDEEP 12288:npsf4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11C65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cc3759dff5a259f236a0bd66c0ea82d1767af4ce1a56bc061ed519289177ec74
MD5 b3c3ddc5323f70f05d6c8aaa71d82202
SHA1 87c96a22e314e3a9a19f27ba5a337d7e09a3c4d3
SHA512 6519b812dc76e502728773bf7c1b846d27c50b8ee32d689d30eb45e3ae0ec9432834b82800e9e389fc013aba408fbd3af486a0d0eb7b712b59d39d65892543bd
SSDEEP 12288:7YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD552393528C55B2F6FD1039853A8438B5497E2C9F5598D3E2043A5EA238FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 30642f85d6e30792b2126605a54d521608cada326aea3d5938d123a26e55c937
MD5 de1d56d5d5a8d11f5af4cfd4bad39190
SHA1 aea8af233d30d91193e91c9e9043f720fdafb073
SHA512 a0022ff6bc4a1d18970c258791544921a40e61bbff930007f377d0b1afa45276a0c7dfb383e8e576382ac06f2d5868007ed5ea8054aec8fbb19f198715f9800b
SSDEEP 49152:sa0h2GEkuAe73q3pp46zwwQMLNiXicJFFRGNzj3:sa0hNYG4JwL7wRGpj3
TLSH
T1AA85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 d2413e4d0dad611e5a7f4f9450ada2a22f1c4a74b529f60b9a34d1ce36a0959f
MD5 4456183defa912db26d739772e1a0c23
SHA1 33be8030da9ad141753dc65ab7d21ccb995909c3
SHA512 d1d80c683b4baf9a2639f9cbaea5a6c4e4dac4a15a54c96bd5283c66bafe2399a2530d3a5fad88b7d306bd26c08197c3b3a6f089727ffa4a23a100ee2c44b1ce
SSDEEP 24576:8hbHjPf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8hbHjHLNiXicJFFRGNzj3
TLSH
T1605512BE129C20E5F5B5903D85668409E370BC29172197EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d3be37fd876c09e84510e5159e2bb8a9775449dc66abe4d7bfd5aac4f7f2b17d
MD5 df41afd5aa9fc10a96c06e18eb1350df
SHA1 0b006e7101e14fbb01d79d400ce15cbdef53625d
SHA512 eb0cff3d3451ec925a03634aaa80c775ad1e095dd7452c049f747b0c3d7e0f653132b618042b991305063de4a9159e2e5537143567e6147e3f0fc710893a5ac0
SSDEEP 24576:03YgnJcRTk4yti+R5dBR/X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0IgnaTk46pBR/XLNiXicJFFRGNzj3
TLSH
T14745B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 14234ecb2f29496e8b0c11cd0a73b329881c7ec7d2478709defa25cc78f4bf65
MD5 4409da6f4abe3bf075b4c89a7ba4d7ee
SHA1 0cd1a71aeba7da4c3ca45c37aa06b4b6c1fd1344
SHA512 d4e942d767e7f43c424bf41a5ca1f26a931f370c330bd0e3db6e0e6272a477808bdcca2b22ce297c02aa16318fa7bbf6a0f18d1b9066fed13d1e0eea5a6043d8
SSDEEP 12288:HkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Hu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12E5523D3518955B1EAFD403D867A4428B5442F2C9B2619E3E1543D1EA27CFEFCF38122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 9b50ec5550eb88e5d633ba88c14f84709b55db3f01b5cfc4890075b629393339
MD5 03ff0a064650daded13f4f24479da721
SHA1 7cc9121b6bed1af1ea9081d2cdb7b2ace1eb0226
SHA512 1e41d5a3a24bd97a095512fc09af2427dab9767fb96246377a34369616ea113dface438fda3f129e63cc93bc7574f62c215d67839702015786bdb01bf65c3895
SSDEEP 24576:2AL3UTJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2AL3UdLNiXicJFFRGNzj3
TLSH
T1F4750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 c79d2c8411e1cb433872e22e56a787d28837022e308fcb0f9c6164de2b73a8a4
MD5 95829fbed983fd0fa56c19190aabe113
SHA1 33aafc6f863dc45278351ab1a177503b770ddf55
SHA512 5fff3ce795bc7e584dead7aa5eb106ff9f1e8c7219fbf5c481b808124284fa38383c32eb158705476f529a4b4ba29b012def6d83bad3002cbc23de864c98aa15
SSDEEP 24576:ZO9/TwSfVcYG3K/cJHlnFR+IGNe8j3IzN:ZO9LNiXicJFFRGNzj3k
TLSH
T14455125A32DC10F4E5B9903D8AA2820CE371BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 65541555bee52ff774efd86db90a2a861a2227c3afee9bcb3b37aa6df56fc6f2
MD5 5f84112fa83d46ce0d5d37fc4e3fa3c8
SHA1 f58b0e62fe59242882151ef6637d76bd1ed92503
SHA512 3358952beb1742ac4fa6d60bc56c3db218ca827f328c796f38f4961781781944fb871896e626106a11ea120c59859f6c94333a70544334b17d34baa269ef6888
SSDEEP 24576:B7NM9YqZqmWMUkPjZM48Mv6bEhsa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:B7cBWMpPjN8DbEh/LNiXicJFFRGNzj3
TLSH
T1DF65AE2E6BEC81E5D476D13DC9A28205F6F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f1491aa0b430b3707447764262f0c4c106345f39efda87e21e775bdb50c0fde1
MD5 58cc8b662cb31e4b0bf95624862e58fe
SHA1 fba96c6bd39a4ce0c4f14c2ca7e18c9a0185ab3e
SHA512 2375caf758087df9b8f73746f960f012b8cf081b8e29fedbc7e9f21535c1fce97b5052251352a1de9df8682315660e967ecb23df85344946f492c9b7c8824e1a
SSDEEP 49152:rF2YuHNETovAvNYf8km6LNiXicJFFRGNzj3:K6BCf8k97wRGpj3
TLSH
T146858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 371571889fea698eb4c9e83b9f59857e69ddfb518dc7bd5d9922c7f5dae62070
MD5 fca8502f3ce67c6583ed0c0a166c3961
SHA1 7f307875d66a242f71e2bda3a2e5aa3eda03f744
SHA512 d2dc7fb034b84486623b925af1bf7f3d387ac56a5b8ead08262b2d7bcd87edfefee08b9758a54ffb7ab0943affb903ee24d0ebda5df2987bc8f9332497d3612a
SSDEEP 24576:mAFs06+Omlf8NXEbTox/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PFs060loXusLNiXicJFFRGNzj3
TLSH
T15565BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 d5641ab80ae8e3456d8f8d018ffb63a99c23b565e98b3ab918a6494a1b0356b1
MD5 66341c140b2ca873618298d48850507e
SHA1 7336a7d79a77eca3451d9f9bd1ce40ccf9c1d1f7
SHA512 5ea153a633b2910f6838625c4baca73ae20644304ec57e1154d80ead93385cea4d48ad49f2b8c629372c3f00579e4414d1b4e7577c6753f21c1b9ebf7dedb5bb
SSDEEP 24576:aJnJ5D3WXs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aJnJ5DGXsLNiXicJFFRGNzj3
TLSH
T18C75D02DD29810F8E4B7C274825A1655FE72383D2F226AC724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3b5dac97edd85cb72955dca7c860841ecedb38de894e93d1daacc2e6e3f1a755
MD5 bc9770b67468a7cad9bf5f9c07332ca0
SHA1 66fe22d50ba23e66c069b1d31f8ec525e0939c09
SHA512 e45a0ee92b856e972c7a813a9de40d8479b4b7c44713fcd44ef7301560338d30b9744004a72f96c8c2ff63061a6d71c18e8975014dba398d6d8e5178eccf6b9c
SSDEEP 49152:yg06DIKdwc+eQnSt65aV2LNiXicJFFRGNzj3:ro7wRGpj3
TLSH
T177956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 9757108f16dc78c93afc3e741df1877cba24a28609c7193685d80a251cd3ee92
MD5 00a1920a2f6f35093cf60345322f043d
SHA1 88b41d550af85327ac2c91d1a2ec46385a6c8480
SHA512 a158d33600baa7d861aaa6fdfc15f3acccf2a231875fa2afec89fed68ad50a3f859816da943c1d26e96ae95e010ff5f67c5037d0f2017f22e06bf70db9ec0d9b
SSDEEP 24576:6nQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6nQLNiXicJFFRGNzj3
TLSH
T1A55512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 02ad56ac526200827103bb5229cc80fc0e0f4d1e7da11832ba9718fc2591261a
MD5 61fc25f0e6e157409b2da5fe36fa5d61
SHA1 29e3cfa98fd116032a03d3f6034b4a146217f9ab
SHA512 661dbdc3bf5a312e02039d406b2fc2ac184852548244607436579cac265a8d2e62545c54198340b231e20f8d2d83c2cf47feabd558a706c4e9f86829366bf4d3
SSDEEP 24576:dIyv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dIcLNiXicJFFRGNzj3
TLSH
T168651245538850E5EAB9013CCA778064EA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 689f62dfd44691f83e5b5363829c710aa997e2d364693587d2e54476babede73
MD5 4b9e1bdfcdea816f4d1d09c8f3e2a868
SHA1 d236c79262898885b269db1834159dd1fb840dd0
SHA512 08afa15cdfedd69d610c2f94e9b6e11ef9ec18808c3e8d963e4d8473745857d762e4c99076ff7f7d68eb2d45588ecb4653e8b31e2fce49fc9982bc2d5854e72a
SSDEEP 12288:hyhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15355239A118964B1FABD003D86354824F1543E3C9B2628F7A1947A3ED379FDBDF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 50951cfb3a55526350ddecb8a8724af4348964429c49ff817b98c7c78efe59da
MD5 7623736f9b45dbfa800413974a2e6c9d
SHA1 8a120ac3061f551a45013756a4075e5bed4729ef
SHA512 c1a56f993da096a6c51e3df611590652c860b234189d04199e66553462b765deb64f24367cb00f5ed1cfdcdabb4ecd225cccd14d30a31dff07dbc04f23b3e00b
SSDEEP 24576:AQ9MxZKdcz9dw3i/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AVKZiLNiXicJFFRGNzj3
TLSH
T16D558D2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 dac5d99f79db94cb4a5af9a47ed80fc4ca26802da67008fc9d7cc17df5a7ed20
MD5 cab3325f647ef2460ae279e69e59a421
SHA1 a9729d2d25dda6cea0a717d649e52aa195bbcbd5
SHA512 ae754be1f237339461ed5b486c0d08a62cee69e8d361ba7a2faa9419cb700ef549dbefb28d83f100b7bb013a345b0f479b3bdf38e6dac9a18778bc6f24f1bdbd
SSDEEP 24576:FyocDApT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YocDApTLNiXicJFFRGNzj3
TLSH
T1BB65E05FB76D40A2E176813C89858204E773B4345B6257CB6281C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 edd835dbeec6befdf94ff3fcaf96db63382fd42c1ea864c498bb3762625f4db0
MD5 8dc50e0b33c488b94e1bf1ad5be15784
SHA1 4abdcb3850237168f1ae2bf342a4a7b5bb308ff7
SHA512 019b30700166688a74ec5738de305be9da4a520b758a3a3aa0f7bc9745fa2856575ea4b515066b82830366e8d9b0f2a8a11a2df3232b03d88e4c432449f2dcb4
SSDEEP 49152:tWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKTLNiXicJFFRGNzj3:N0zuNIJ7wRGpj3
TLSH
T1A2A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1b134cdbeff4162f5e3d1e03bc3fdced702ac48402c7609868b1cce364df1fe9
MD5 c1f4c1ad891253d51379d8c61bac7b3c
SHA1 a7c0827c72428011cc9da6351bd91bd039a01ee0
SHA512 20e7a050e5de6717ff6b75bfdb08de76ea908d44ae60635255b5cbe92eea06f3d93ee5f99b2d1376d3e59f26d5d2a6ba47e872b0eee89e1bc8dfd5c86a26fe96
SSDEEP 24576:A1QT7EcpfxR+N5AWAz3ooiYzjMqbQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9TDxR+N5YzTBjMdLNiXicJFFRGNzj3
TLSH
T1E155B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 62ac4700f09c04ebcaf0ef4fcd2b44ce969676873ef7b078909a3513fd2f214f
MD5 9ae0ff3224b4d0986428b7ec769e973e
SHA1 86aa7143f04f57f8af10e9dffd806abc805c34d1
SHA512 b4ba99e7b57d2cba349ffdf75a17b058686a7da84fd96c958cf31d3459e0308aaf3775d1f1189dc571482125cb39511dd498bda6c22ce38accf7097a39dd0412
SSDEEP 24576:KTMdOz0FFS+UmSLU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:G0K+UmSLULNiXicJFFRGNzj3
TLSH
T1C275E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 d03a5c5fa497b93af2fad156588b68980a02994c816b5d363c9bc17b088d5f53
MD5 0b1b36cc5301118f8237a1c8010aeec3
SHA1 87bd3ed385e8dd2f4b7b6a332927f3b9b2948af8
SHA512 bff612289b004b53db248a770dc8bb96481d8ca3129a7350cbb77fab557d7b525b5a6e2d8c5b51947eb123a4db101dd48f67404572b637d537882dbcd8a17784
SSDEEP 12288:C4KFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18855125A13D830E0F5BA5139CA364014E660BC3957251AFF71D0A97E9B36FDACE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/372-282-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/372-41-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/372-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/688-387-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/688-1-0x0000000000180000-0x00000000001E0000-memory.dmp

Download

memory/688-351-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/688-3-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/688-380-0x0000000000180000-0x00000000001E0000-memory.dmp

Download

memory/688-9-0x0000000000180000-0x00000000001E0000-memory.dmp

Download

memory/852-292-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/904-297-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1524-64-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1728-85-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1728-79-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1728-284-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/1744-293-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2124-291-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/2668-37-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2668-31-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2668-281-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2836-69-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2836-75-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2836-283-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2928-295-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/2928-353-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3128-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3128-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3128-63-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3128-57-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3284-367-0x000001BC74340000-0x000001BC74350000-memory.dmp

Download

memory/3284-369-0x000001BC74340000-0x000001BC74350000-memory.dmp

Download

memory/3284-373-0x000001BC74340000-0x000001BC74350000-memory.dmp

Download

memory/3284-370-0x000001BC74340000-0x000001BC74350000-memory.dmp

Download

memory/3284-440-0x000001BC71880000-0x000001BC73757000-memory.dmp

Download

memory/3284-372-0x000001BC74340000-0x000001BC74350000-memory.dmp

Download

memory/3284-371-0x000001BC74340000-0x000001BC74350000-memory.dmp

Download

memory/3284-355-0x000001BC71880000-0x000001BC73757000-memory.dmp

Download

memory/3284-365-0x000001BC74340000-0x000001BC74350000-memory.dmp

Download

memory/3284-364-0x000001BC74340000-0x000001BC74350000-memory.dmp

Download

memory/3284-368-0x000001BC74340000-0x000001BC74350000-memory.dmp

Download

memory/3284-358-0x000001BC74340000-0x000001BC74350000-memory.dmp

Download

memory/3284-359-0x000001BC74340000-0x000001BC74350000-memory.dmp

Download

memory/3284-360-0x000001BC74340000-0x000001BC74350000-memory.dmp

Download

memory/3284-362-0x000001BC74340000-0x000001BC74350000-memory.dmp

Download

memory/3284-363-0x000001BC74340000-0x000001BC74350000-memory.dmp

Download

memory/3284-361-0x000001BC74340000-0x000001BC74350000-memory.dmp

Download

memory/3284-366-0x000001BC74340000-0x000001BC74350000-memory.dmp

Download

memory/3348-294-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3464-125-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3464-290-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3464-119-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3864-132-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3944-14-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3944-352-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4092-167-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4092-296-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4092-354-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4092-151-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4092-377-0x000000000E410000-0x000000000E418000-memory.dmp

Download

memory/4092-349-0x000000000CD90000-0x000000000CD98000-memory.dmp

Download

memory/4092-186-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4720-345-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4720-287-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4772-23-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4772-25-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4772-17-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4796-285-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4796-97-0x00000000006C0000-0x0000000000726000-memory.dmp

Download

memory/4796-92-0x00000000006C0000-0x0000000000726000-memory.dmp

Download

memory/4908-286-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4988-114-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4988-108-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4988-289-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5104-288-0x0000000140000000-0x00000001401ED000-memory.dmp

Download